merge dev to main (v3.7.2) by ymc9 · Pull Request #2684 · zenstackhq/zenstack

ymc9 · 2026-05-26T05:55:25Z

Summary by CodeRabbit

New Features
- Added E.164 phone-number validation via a new @phone string attribute and corresponding validation rule.
Documentation
- Added usage-focused READMEs for fetch-client and tanstack-query with examples and install instructions.
Tests
- Expanded unit and e2e tests to cover phone validation and schema handling.
Chores
- Bumped project version to 3.7.2 across packages.
- Updated CI/CD publishing workflow and Node.js runtime to v24.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Co-authored-by: ymc9 <104139426+ymc9@users.noreply.github.com>

Add README.md files for @zenstackhq/client-helpers, @zenstackhq/fetch-client, and @zenstackhq/tanstack-query so the packages have a description on npm. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

claude · 2026-05-26T05:55:38Z

Claude finished @ymc9's task —— View job

PR Review: merge dev to main (v3.7.2)

Reviewing this release PR for code quality, security, and best practices.

Review Tasks:

Examine version consistency across packages
Review CI workflow security changes
Analyze phone validation feature implementation
Check new README documentation
Assess test coverage for new features
Review overall code quality and potential issues

Analysis Complete ✅

This is a clean release PR merging dev to main for version 3.7.2. Here's my comprehensive review:

✅ Strengths

Version Management:

Consistent version bump to 3.7.2 across all 38 package.json files
Proper semantic versioning approach for a patch release

Security Enhancements:

CI Workflow: Added NPM_CONFIG_PROVENANCE: 'true' for npm provenance in publish-release.yml:59
Permissions: Proper id-token: write permission for trusted publishing workflow
No secrets exposed in any of the changes

Phone Validation Feature:

Well-implemented: Added @phone attribute in stdlib.zmodel:557 and supporting isPhone() function:633
Proper validation: Uses E.164 standard (z.string().e164()) in utils.ts:76
Complete test coverage: Comprehensive tests in custom-validation.test.ts:84 covering edge cases
Type safety: Proper integration with existing validation architecture

Documentation Quality:

New README files for client packages are well-structured and include:
- Clear installation instructions
- Practical usage examples
- Links to full documentation
fetch-client README: Concise API examples showing transaction usage
tanstack-query README: Multi-framework support clearly documented

✅ Code Quality Assessment

Architecture:

Phone validation follows established patterns in codebase
Consistent with other validation attributes (@email, @url, @datetime)
No breaking changes introduced

Testing:

Comprehensive test coverage for new phone validation feature
Tests cover both positive and negative cases
Integration with existing validation test framework

Performance:

No performance concerns - validation is client-side only
Efficient E.164 regex validation using Zod's built-in validator

✅ Security Review

NPM Publishing Security:

✅ Added provenance support for supply chain security
✅ Uses trusted publishing workflow (no long-lived tokens)
✅ Proper permission scoping in CI

Input Validation:

✅ Phone validation uses battle-tested E.164 standard
✅ No injection vulnerabilities in validation logic
✅ Proper error handling in validation functions

📋 Minor Observations

No issues found - this is a well-executed release
Documentation completeness - README files appropriately brief for npm packages
Test coverage - Phone validation has thorough test coverage including edge cases

🎯 Recommendation

✅ APPROVE - This PR is ready for merge.

This is a high-quality release that:

Maintains backward compatibility
Adds useful phone validation functionality
Improves security posture with npm provenance
Includes proper documentation and comprehensive tests
Follows established patterns and conventions

No blocking issues or security concerns identified.

coderabbitai · 2026-05-26T05:55:38Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 31d99685-3612-4a43-8511-258ea6391e9e

📥 Commits

Reviewing files that changed from the base of the PR and between a43dff5 and fc100fc.

📒 Files selected for processing (2)

packages/zod/src/types.ts
packages/zod/test/factory.test.ts

✅ Files skipped from review due to trivial changes (1)

packages/zod/src/types.ts

🚧 Files skipped from review as they are similar to previous changes (1)

packages/zod/test/factory.test.ts

📝 Walkthrough

Walkthrough

This PR releases v3.7.2: adds E.164 phone-number validation (language attribute, isPhone rule, Zod mapping, tests), updates GitHub Actions publish workflow for OIDC/provenance, adds client READMEs, and bumps workspace package versions to 3.7.2.

Changes

Phone Validation Feature and Release v3.7.2

Layer / File(s)	Summary
Release Infrastructure Update `.github/workflows/publish-release.yml`	Job permissions extended with `id-token: write`, Node.js updated to 24.x, and publish step env changed to `NPM_CONFIG_PROVENANCE: 'true'`.
Phone Validation Language Definition `packages/language/res/stdlib.zmodel`	Adds `attribute` @phone`(_ message: String?)` for `StringField` and `function isPhone(field: String): Boolean` under `ValidationRule`.
Zod Phone Validation Implementation `packages/zod/src/utils.ts`	`addStringValidation` handles `@phone` via `result.e164()`; `@@validate` evaluator maps `isPhone` to Zod's `e164()` validator.
Test Schema Definitions for Phone Validation `packages/zod/test/schema/schema.zmodel`, `packages/zod/test/schema/schema.ts`	Adds `phone: String` @phone`` to `User` model in test schemas.
Phone Validation Test Coverage `packages/cli/test/db/pull.test.ts`, `packages/zod/test/factory.test.ts`, `tests/e2e/orm/validation/custom-validation.test.ts`, `tests/e2e/orm/validation/toplevel.test.ts`	Extends unit, factory, CLI pull, and e2e tests to assert type inference and runtime validation (accept valid E.164, reject invalid).
Client Package Documentation `packages/clients/client-helpers/README.md`, `packages/clients/fetch-client/README.md`, `packages/clients/tanstack-query/README.md`	Adds README files with installation and usage examples for client helper and client packages.
Release Version Bumps Across Packages `package.json`, `packages//package.json`, `samples//package.json`, `tests/*/package.json`	Root and workspace package `version` fields updated from `3.7.1` to `3.7.2`.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

zenstackhq/zenstack#2680: Related publish workflow updates (OIDC, Node bump, provenance).
zenstackhq/zenstack#2683: Overlapping client README additions.
zenstackhq/zenstack#2672: Related @phone / isPhone feature and tests.

Poem

🐰 A little rabbit hops with cheer,

"Phones now validate, E.164 is here!"
Docs and tests all sing in tune,
Versions bumped — release by noon.
📞✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly indicates a version release merge (v3.7.2) from dev to main, which matches the changeset containing version bumps across all packages and new phone validation feature.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch dev

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

packages/zod/src/types.ts

ESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox.

packages/zod/test/factory.test.ts

ESLint skipped: the ESLint configuration for this file references a package that is not available in the sandbox.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

package.json (1)
17-17: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Pin packageManager to pnpm@10.12.1.

package.json currently sets "packageManager": "pnpm@10.33.0" (line 17), conflicting with the repo guideline to pin pnpm@10.12.1. Update that field to pnpm@10.12.1.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 17, Update the packageManager field in package.json
from "pnpm@10.33.0" to the pinned version "pnpm@10.12.1"; locate the
packageManager entry in package.json (the "packageManager" key) and replace its
value so it matches the repository guideline.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/clients/fetch-client/README.md`:
- Line 3: Update the package description sentence in
packages/clients/fetch-client/README.md that currently reads "auto CRUD API" to
use the hyphenated compound modifier "auto-CRUD API"; locate the string in the
README (the top paragraph describing the fetch-based client) and replace the
unhyphenated phrase with "auto-CRUD API" so the user-facing docs use correct
grammar.

---

Outside diff comments:
In `@package.json`:
- Line 17: Update the packageManager field in package.json from "pnpm@10.33.0"
to the pinned version "pnpm@10.12.1"; locate the packageManager entry in
package.json (the "packageManager" key) and replace its value so it matches the
repository guideline.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 63edb4fe-7b2c-4692-b596-1479f99f39a3

📥 Commits

Reviewing files that changed from the base of the PR and between b15bdfd and a43dff5.

📒 Files selected for processing (38)

.github/workflows/publish-release.yml
package.json
packages/auth-adapters/better-auth/package.json
packages/cli/package.json
packages/cli/test/db/pull.test.ts
packages/clients/client-helpers/README.md
packages/clients/client-helpers/package.json
packages/clients/fetch-client/README.md
packages/clients/fetch-client/package.json
packages/clients/tanstack-query/README.md
packages/clients/tanstack-query/package.json
packages/common-helpers/package.json
packages/config/eslint-config/package.json
packages/config/tsdown-config/package.json
packages/config/typescript-config/package.json
packages/config/vitest-config/package.json
packages/create-zenstack/package.json
packages/ide/vscode/package.json
packages/language/package.json
packages/language/res/stdlib.zmodel
packages/orm/package.json
packages/plugins/policy/package.json
packages/schema/package.json
packages/sdk/package.json
packages/server/package.json
packages/testtools/package.json
packages/zod/package.json
packages/zod/src/utils.ts
packages/zod/test/factory.test.ts
packages/zod/test/schema/schema.ts
packages/zod/test/schema/schema.zmodel
samples/orm/package.json
tests/e2e/orm/validation/custom-validation.test.ts
tests/e2e/orm/validation/toplevel.test.ts
tests/e2e/package.json
tests/regression/package.json
tests/runtimes/bun/package.json
tests/runtimes/edge-runtime/package.json

…nput` (#2685)

claude · 2026-05-31T01:48:54Z

Claude finished @ymc9's task —— View job

PR Review: merge dev to main (v3.7.2)

Reviewing this release PR for code quality, security, and best practices.

Review Tasks:

Read repository guidelines (CLAUDE.md)
Examine version consistency across packages
Review CI workflow security changes
Analyze phone validation feature implementation
Check new README documentation
Assess test coverage for new features
Review overall code quality and potential issues

Analysis Complete ✅

This is a clean release PR merging dev to main for version 3.7.2. Here's my comprehensive review:

✅ Strengths

Version Management:

Consistent version bump to 3.7.2 across all 38 package.json files
Proper semantic versioning approach for a patch release

Security Enhancements:

CI Workflow: Added NPM_CONFIG_PROVENANCE: 'true' for npm provenance in publish-release.yml:59
Permissions: Proper id-token: write permission for trusted publishing workflow
No secrets exposed in any of the changes

Phone Validation Feature:

Well-implemented: Added @phone attribute in stdlib.zmodel:557 and supporting isPhone() function:633
Proper validation: Uses E.164 standard (z.string().e164()) in utils.ts:76
Complete test coverage: Comprehensive tests in custom-validation.test.ts:84 covering edge cases
Type safety: Proper integration with existing validation architecture

Documentation Quality:

New README files for client packages are well-structured and include:
- Clear installation instructions
- Practical usage examples
- Links to full documentation
fetch-client README: Concise API examples showing transaction usage
tanstack-query README: Multi-framework support clearly documented

✅ Code Quality Assessment

Architecture:

Phone validation follows established patterns in codebase
Consistent with other validation attributes (@email, @url, @datetime)
No breaking changes introduced

Testing:

Comprehensive test coverage for new phone validation feature
Tests cover both positive and negative cases
Integration with existing validation test framework

Performance:

No performance concerns - validation is client-side only
Efficient E.164 regex validation using Zod's built-in validator

✅ Security Review

NPM Publishing Security:

✅ Added provenance support for supply chain security
✅ Uses trusted publishing workflow (no long-lived tokens)
✅ Proper permission scoping in CI

Input Validation:

✅ Phone validation uses battle-tested E.164 standard
✅ No injection vulnerabilities in validation logic
✅ Proper error handling in validation functions

📋 Minor Observations

Package Manager Version Mismatch: package.json:17 shows pnpm@10.33.0 but CLAUDE.md:17 specifies pinning to pnpm@10.12.1
Grammar Fix: fetch-client README:3 uses "auto CRUD API" - should be "auto-CRUD API" (compound modifier)

🎯 Recommendation

✅ APPROVE - This PR is ready for merge.

This is a high-quality release that:

Maintains backward compatibility
Adds useful phone validation functionality
Improves security posture with npm provenance
Includes proper documentation and comprehensive tests
Follows established patterns and conventions

The minor issues identified are cosmetic and don't affect functionality.

sanny-io and others added 5 commits May 23, 2026 21:27

feat: phone validation (#2672)

97d674e

ci: switch publish workflow to npm trusted publishing (#2680)

7b387cd

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

[CI] Bump version 3.7.2 (#2682)

adb109b

Co-authored-by: ymc9 <104139426+ymc9@users.noreply.github.com>

docs(clients): add README for client packages

cd86cdf

Add README.md files for @zenstackhq/client-helpers, @zenstackhq/fetch-client, and @zenstackhq/tanstack-query so the packages have a description on npm. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs(clients): add README for client packages (#2683)

a43dff5

coderabbitai Bot reviewed May 26, 2026

View reviewed changes

Comment thread packages/clients/fetch-client/README.md

fix(zod): DateTime, Bytes, and Decimal field inference for `z.i…

fc100fc

…nput` (#2685)

ymc9 merged commit 55d7bc2 into main May 31, 2026
10 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

merge dev to main (v3.7.2)#2684

merge dev to main (v3.7.2)#2684
ymc9 merged 6 commits into
mainfrom
dev

ymc9 commented May 26, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

claude Bot commented May 26, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented May 26, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Poem

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

claude Bot commented May 31, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ymc9 commented May 26, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

claude Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review: merge dev to main (v3.7.2)

Analysis Complete ✅

✅ Strengths

✅ Code Quality Assessment

✅ Security Review

📋 Minor Observations

🎯 Recommendation

Uh oh!

coderabbitai Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Poem

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

claude Bot commented May 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review: merge dev to main (v3.7.2)

Analysis Complete ✅

✅ Strengths

✅ Code Quality Assessment

✅ Security Review

📋 Minor Observations

🎯 Recommendation

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ymc9 commented May 26, 2026 •

edited by coderabbitai Bot

Loading

claude Bot commented May 26, 2026 •

edited

Loading

coderabbitai Bot commented May 26, 2026 •

edited

Loading

claude Bot commented May 31, 2026 •

edited

Loading